Is it possible to measure the risk of terrorism? Measuring risk can be difficult, but it is done as a matter of course in such highly charged areas as nuclear power plant safety, airplane safety, and environmental protection. There is adequate information about terrorism: There is plenty of data on how much damage terrorists have been able to do over the decades and about how frequently they attack. The insurance industry has a distinct financial imperative to understand terrorism risks to write policies for it. If the private sector can estimate terrorism risks and is willing to risk its own money on the validity of the estimate, why can't the Department of Homeland Security?

A conventional approach to cost-effectiveness compares the costs of security measures with the benefits as tallied in lives saved and damages averted. The benefit of a security measure is a multiplicative composite of three considerations: the probability of a successful attack, the losses sustained in a successful attack, and the reduction in risk furnished by security measures. This product, the benefit, is then compared to the cost of the security measure instituted to attain the benefit. A security measure is cost-effective when the benefit of the measure outweighs the costs of providing the security measures.

The interaction of these variables can perhaps be seen in an example. Suppose there is a dangerous curve on a road that results in an accident from time to time. To evaluate measures designed to deal with this problem, the analyst would need to estimate 1) the probabilityof an accident each year under present conditions, 2) the costs of the consequences of the accident (death, injury, property damage), and 3) the degree to which a proposed safety measure lowers the probability of an accident (erecting warning signs) and/or the losses sustained in the accident (erecting a crash barrier). If the benefits of the risk-reduction measures—these three items multiplied together—outweigh their costs, the measures would be deemed cost-effective.

These considerations can be usefully wrinkled around a bit in a procedure known as "break-even analysis" to calculate how many attacks would have to take place to justify a security expenditure.

We apply this approach to the overall increase in domestic homeland security spending by the federal government (including for national intelligence) and by state and local governments. That is, we assume homeland security measures are in place before the attacks continue, and we evaluate the additional funds that have been allocated to homeland security, almost all of it designed, of course, to deal with terrorism, the only hazard that notably inspired increased alarm after the attacks. By 2009, this increase totaled some $75 billion per year. This is a very conservative measure of the degree to which homeland security expenditures have risen since 9/11 because it excludes items such as private sector expenditures, hidden and indirect costs of implementing security-related regulations, and the costs of the terror-related (or terror-impelled) wars in Iraq and Afghanistan.

To evaluate the reduction in risk provided by security measures, we need to consider their effectiveness in foiling, deterring, disrupting, or protecting against a terrorist attack. In assessing risk reduction, it is important first to look at the effectiveness of homeland security measures that were in place before 9/11. The 9/11 Commission's report points to a number of failures, but it acknowledges as well that terrorism was already a high priority of the government before 9/11. More pointed is an observation of Michael Sheehan, former New York City deputy commissioner for counterterrorism: "The most important work in protecting our country since 9/11 has been accomplished with the capacity that was in place when the event happened, not with any of the new capability bought since 9/11. I firmly believe that those huge budget increases have not significantly contributed to our post-9/11 security."

There is another consideration. The tragic events of 9/11 massively heightened the awareness of the public to the threat of terrorism, resulting in extra vigilance that has often resulted in the arrest of terrorists or the foiling of terrorist attempts.

In our analysis we will assume that risk reduction caused by the security measures in place before 9/11 and by the extra vigilance of the public after that event reduced risk by 50 percent. This is an exceedingly conservative estimate not only because of Sheehan's observation but because security measures that are at once effective and relatively inexpensive are generally the first to be implemented—for example, one erects warning signs on a potentially dangerous curve in the road before rebuilding the highway. Furthermore, most terrorists (or would-be terrorists) do not show much intelligence, cleverness, resourcefulness, or initiative, and therefore measures to deal with them are relatively inexpensive and are likely to be instituted first. Dealing with the smarter and more capable terrorists is more difficult and expensive, but these people represent, it certainly appears, a decided minority among terrorists.

In addition, we will assume that the increase in U.S. expenditures on homeland security since 2001 has been dramatically effective, reducing the remaining risk by an additional 45 percent. Total risk reduction, is generously assumed, then, to be 95 percent with the pre-existing measures and the extra public vigilance responsible for 50 percent of the risk reduction and the enhanced expenditures responsible for the remaining 45 percent.

Putting this all together, we find that, in order for the $75 billion in enhanced expenditures on homeland security to be deemed cost-effective under our approach—which substantially biases the consideration toward finding them effective—they would have to deter, prevent, foil, or protect each year against 1,667 otherwise successful attacks of something like the one attempted in Times Square in 2010. In other words, we'd have to foil more than four major attacks every day to justify the spending.

We are not arguing that much of homeland security spending is wasteful because we believe there will be no more terrorist attacks. Like crime and vandalism, terrorism will always be a feature of life, and a condition of zero vulnerability is impossible to achieve. However, the frequency and severity of terrorist attacks are generally very low, which makes the benefits of enhanced counterterrorism expenditures of a trillion dollars since 9/11 challenging, to say the least, to justify by any rational and accepted standard of cost-benefit analysis.

Our findings dealing with the total enhanced homeland security expenditures should not be taken to suggest that all security measures necessarily fail to be cost-effective: There may be specific measures that are cost-effective. But each should be subjected to the kind of risk analysis we have applied to the overall increases in expenditure.

Advertisement

We have done so for several specific measures. It appears, for example, that the protection of a standard office-type building would be cost-effective only if the likelihood of a sizable terrorist attack on the building is 1,000 times greater than it is at present. Something similar holds for the protection of bridges. On the other hand, hardening cockpit doors may be cost-effective, though the provision for air marshals on the planes decidedly is not. The cost-effectiveness of full-body scanners is questionable at best. Overall, by far the most cost-effective counterterrorism measure is to refrain from overreacting.

We have assessed the hazard terrorism poses under present conditions—which include, of course, the existence of counterterrorism measures specifically designed to reduce that hazard. The analysis suggests that additional efforts to reduce its likelihood are scarcely justified.

It is possible, of course, that any relaxation in these measures will increase the terrorism hazard, that the counterterrorism effort is the reason for the low-hazard terrorism currently present. However, in order for the terrorism risk to border on becoming "unacceptable" by established risk conventions, the number of fatalities from all forms of terrorism in the United States would have to increase 35-fold, equivalent to experiencing attacks as devastating as those on 9/11 at least once a year or 18 Oklahoma City bombings every year. Even if all the (mostly embryonic and in many cases moronic) terrorist plots exposed since 9/11 in the United States had been successfully carried out, their likely consequences would have been much lower. Indeed, as noted earlier, the number of people killed by terrorists throughout the world outside (and sometimes within) war zones both before and after 2001 generally registers at far below that number.

We have been using "historical" data here, and these suggest the chances an American will perish at the hands of a terrorist are about one in 3.5 million per year. However, although there is no guarantee that the terrorism frequencies of the past will necessarily persist into the future, there seems to be little evidence terrorists are becoming any more destructive, particularly in the West. In fact, as discussed earlier, according both to official and prominent academic accounts, the levels of violence likely to be committed by Islamist extremists within Western countries seems, if anything to be in decline as fears about large, sophisticated attacks have been replaced by fears concerning tiny conspiracies, lone wolves, and one-off attackers.

Those who wish to discount such arguments and projections need to demonstrate why they think terrorists will suddenly get their act together and inflict massively increased violence, visiting savage discontinuities on the historical data series.

Risk reduction measures that produce little or no net benefit to society or produce it at a very high cost cannot be justified on rational life-safety and economic grounds: They are not only irresponsible, but, essentially, immoral. When we spend resources to save lives at a high cost, we forgo the opportunity to spend those same resources on regulations and processes that can save more lives at the same cost, or even at a lower one. Homeland security expenditure invested in a wide range of more cost-effective risk reduction programs like flood protection, vaccination and screening, vehicle and road safety, health care, nutritional programs, and occupational health and safety would likely result in far more significant benefits to society.

John Mueller is a political scientist at Ohio State University and a senior fellow at the Cato Institute.